Endpoint Protection

Hello together,

I have following situation.

Recently we have upgraded 2000 XEN-virtual systems XPSP3Pro from version 11 RU7 MP1 to version 12 MP1 RU1.

In version 11 we have been using Virus, Spyware and Basic Download Protection, Network Threat Protection, TruScan and Application Device Control. So that pretty much all except the Outlook, Notes and POP3 Scanner.

During the upgrade to 12 that was done using the SEPM Update without a reboot enforcement we kept the same settings and removed the Firewall. So installed is AV+AS+SONAR+IPS+Application Device Control+Tamper+Advanced Download Protection.

On a Saturday all the machines were rebooted and were all coming up with the version 12.

Since that time after the reboot when version 12 were present the memory consumption for all the 2000 systems has increased round about 23% consitent. Im not talking about a peak.

Im well aware of Citrix exclusions and I know we could try to remove features to get a different performance. But I would like to see why the Memory consumption has increased that much with the same policy as we dont use Insight Lookups etc. what is more or less a similar policy mapped from version 11 features.

Has anyone experienced the same issue?

Thank you

toby

Hi,

Check which process is taking the highest CPU and Memory usage ?

Adding the registry

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters
- DWORD MaxUserPort, with value 50000 (decimal)

- DWORD TcpTimedWaitDelay, with value 30 (decimal)

would not help

To resolve this issue, increase the value of the IRPStackSize registry entry. To do this, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

   If the IRPStackSize entry is not present in this subkey, follow these steps:

   1. Click Edit, point to New, and then click DWORD Value.
   2. Type IRPStackSize, and then press ENTER.

      NoteType IRPStackSizeexactly as it appears. The value name is case sensitive.

3. Click IRPStackSize, click Edit, and then click Modify.
4. In the Data Value box, type a larger value, and then click OK.

   Note Values may range from 0x1 to 0xC. These values are equivalent to 1 to 12 in decimal notation.

If the problem persists after you complete the previous procedure, increase the value of IRPStackSize more

Sounds useful to give this a try.

Still don't know why this happened

have you check system speed after setting ?

Hi,

finally I was able to check this, but with the Stacksize increase there wasnt any improvement. Still take the same memory usage.

Do you have any other idea?

Thank you in advance

toby